PVE/API2/Qemu.pm

   1 package PVE::API2::Qemu;
   2
   3 use strict;
   4 use warnings;
   5 use Cwd 'abs_path';
   6
   7 use PVE::Cluster qw (cfs_read_file cfs_write_file);;
   8 use PVE::SafeSyslog;
   9 use PVE::Tools qw(extract_param);
  10 use PVE::Exception qw(raise raise_param_exc raise_perm_exc);
  11 use PVE::Storage;
  12 use PVE::JSONSchema qw(get_standard_option);
  13 use PVE::RESTHandler;
  14 use PVE::QemuServer;
  15 use PVE::QemuMigrate;
  16 use PVE::RPCEnvironment;
  17 use PVE::AccessControl;
  18 use PVE::INotify;
  19 use PVE::Network;
  20
  21 use Data::Dumper; # fixme: remove
  22
  23 use base qw(PVE::RESTHandler);
  24
  25 my $opt_force_description = "Force physical removal. Without this, we simple remove the disk from the config file and create an additional configuration entry called 'unused[n]', which contains the volume ID. Unlink of unused[n] always cause physical removal.";
  26
  27 my $resolve_cdrom_alias = sub {
  28     my $param = shift;
  29
  30     if (my $value = $param->{cdrom}) {
  31         $value .= ",media=cdrom" if $value !~ m/media=/;
  32         $param->{ide2} = $value;
  33         delete $param->{cdrom};
  34     }
  35 };
  36
  37
  38 my $check_storage_access = sub {
  39    my ($rpcenv, $authuser, $storecfg, $vmid, $settings, $default_storage) = @_;
  40
  41    PVE::QemuServer::foreach_drive($settings, sub {
  42         my ($ds, $drive) = @_;
  43
  44         my $isCDROM = PVE::QemuServer::drive_is_cdrom($drive);
  45
  46         my $volid = $drive->{file};
  47
  48         if (!$volid || $volid eq 'none') {
  49             # nothing to check
  50         } elsif ($isCDROM && ($volid eq 'cdrom')) {
  51             $rpcenv->check($authuser, "/", ['Sys.Console']);
  52         } elsif (!$isCDROM && ($volid =~ m/^(([^:\s]+):)?(\d+(\.\d+)?)$/)) {
  53             my ($storeid, $size) = ($2 || $default_storage, $3);
  54             die "no storage ID specified (and no default storage)\n" if !$storeid;
  55             $rpcenv->check($authuser, "/storage/$storeid", ['Datastore.AllocateSpace']);
  56         } else {
  57             $rpcenv->check_volume_access($authuser, $storecfg, $vmid, $volid);
  58         }
  59     });
  60 };
  61
  62 my $check_storage_access_clone = sub {
  63    my ($rpcenv, $authuser, $storecfg, $conf, $storage) = @_;
  64
  65    my $sharedvm = 1;
  66
  67    PVE::QemuServer::foreach_drive($conf, sub {
  68         my ($ds, $drive) = @_;
  69
  70         my $isCDROM = PVE::QemuServer::drive_is_cdrom($drive);
  71
  72         my $volid = $drive->{file};
  73
  74         return if !$volid || $volid eq 'none';
  75
  76         if ($isCDROM) {
  77             if ($volid eq 'cdrom') {
  78                 $rpcenv->check($authuser, "/", ['Sys.Console']);
  79             } else {
  80                 # we simply allow access
  81                 my ($sid, $volname) = PVE::Storage::parse_volume_id($volid);
  82                 my $scfg = PVE::Storage::storage_config($storecfg, $sid);
  83                 $sharedvm = 0 if !$scfg->{shared};
  84
  85             }
  86         } else {
  87             my ($sid, $volname) = PVE::Storage::parse_volume_id($volid);
  88             my $scfg = PVE::Storage::storage_config($storecfg, $sid);
  89             $sharedvm = 0 if !$scfg->{shared};
  90
  91             $sid = $storage if $storage;
  92             $rpcenv->check($authuser, "/storage/$sid", ['Datastore.AllocateSpace']);
  93         }
  94     });
  95
  96    return $sharedvm;
  97 };
  98
  99 # Note: $pool is only needed when creating a VM, because pool permissions
 100 # are automatically inherited if VM already exists inside a pool.
 101 my $create_disks = sub {
 102     my ($rpcenv, $authuser, $conf, $storecfg, $vmid, $pool, $settings, $default_storage) = @_;
 103
 104     my $vollist = [];
 105
 106     my $res = {};
 107     PVE::QemuServer::foreach_drive($settings, sub {
 108         my ($ds, $disk) = @_;
 109
 110         my $volid = $disk->{file};
 111
 112         if (!$volid || $volid eq 'none' || $volid eq 'cdrom') {
 113             delete $disk->{size};
 114             $res->{$ds} = PVE::QemuServer::print_drive($vmid, $disk);
 115         } elsif ($volid =~ m/^(([^:\s]+):)?(\d+(\.\d+)?)$/) {
 116             my ($storeid, $size) = ($2 || $default_storage, $3);
 117             die "no storage ID specified (and no default storage)\n" if !$storeid;
 118             my $defformat = PVE::Storage::storage_default_format($storecfg, $storeid);
 119             my $fmt = $disk->{format} || $defformat;
 120             my $volid = PVE::Storage::vdisk_alloc($storecfg, $storeid, $vmid,
 121                                                   $fmt, undef, $size*1024*1024);
 122             $disk->{file} = $volid;
 123             $disk->{size} = $size*1024*1024*1024;
 124             push @$vollist, $volid;
 125             delete $disk->{format}; # no longer needed
 126             $res->{$ds} = PVE::QemuServer::print_drive($vmid, $disk);
 127         } else {
 128
 129             my $path = $rpcenv->check_volume_access($authuser, $storecfg, $vmid, $volid);
 130
 131             my ($storeid, $volname) = PVE::Storage::parse_volume_id($volid, 1);
 132
 133             my $foundvolid = undef;
 134
 135             if ($storeid) {
 136                 PVE::Storage::activate_volumes($storecfg, [ $volid ]);
 137                 my $dl = PVE::Storage::vdisk_list($storecfg, $storeid, undef);
 138
 139                 PVE::Storage::foreach_volid($dl, sub {
 140                     my ($volumeid) = @_;
 141                     if($volumeid eq $volid) {
 142                         $foundvolid = 1;
 143                         return;
 144                     }
 145                 });
 146             }
 147
 148             die "image '$path' does not exists\n" if (!(-f $path || -b $path || $foundvolid));
 149
 150             my ($size) = PVE::Storage::volume_size_info($storecfg, $volid, 1);
 151             $disk->{size} = $size;
 152             $res->{$ds} = PVE::QemuServer::print_drive($vmid, $disk);
 153         }
 154     });
 155
 156     # free allocated images on error
 157     if (my $err = $@) {
 158         syslog('err', "VM $vmid creating disks failed");
 159         foreach my $volid (@$vollist) {
 160             eval { PVE::Storage::vdisk_free($storecfg, $volid); };
 161             warn $@ if $@;
 162         }
 163         die $err;
 164     }
 165
 166     # modify vm config if everything went well
 167     foreach my $ds (keys %$res) {
 168         $conf->{$ds} = $res->{$ds};
 169     }
 170
 171     return $vollist;
 172 };
 173
 174 my $check_vm_modify_config_perm = sub {
 175     my ($rpcenv, $authuser, $vmid, $pool, $key_list) = @_;
 176
 177     return 1 if $authuser eq 'root@pam';
 178
 179     foreach my $opt (@$key_list) {
 180         # disk checks need to be done somewhere else
 181         next if PVE::QemuServer::valid_drivename($opt);
 182
 183         if ($opt eq 'sockets' || $opt eq 'cores' ||
 184             $opt eq 'cpu' || $opt eq 'smp' ||
 185             $opt eq 'cpulimit' || $opt eq 'cpuunits') {
 186             $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.CPU']);
 187         } elsif ($opt eq 'boot' || $opt eq 'bootdisk') {
 188             $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.Disk']);
 189         } elsif ($opt eq 'memory' || $opt eq 'balloon' || $opt eq 'shares') {
 190             $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.Memory']);
 191         } elsif ($opt eq 'args' || $opt eq 'lock') {
 192             die "only root can set '$opt' config\n";
 193         } elsif ($opt eq 'cpu' || $opt eq 'kvm' || $opt eq 'acpi' ||
 194                  $opt eq 'vga' || $opt eq 'watchdog' || $opt eq 'tablet') {
 195             $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.HWType']);
 196         } elsif ($opt =~ m/^net\d+$/) {
 197             $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.Network']);
 198         } else {
 199             $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.Options']);
 200         }
 201     }
 202
 203     return 1;
 204 };
 205
 206 __PACKAGE__->register_method({
 207     name => 'vmlist',
 208     path => '',
 209     method => 'GET',
 210     description => "Virtual machine index (per node).",
 211     permissions => {
 212         description => "Only list VMs where you have VM.Audit permissons on /vms/<vmid>.",
 213         user => 'all',
 214     },
 215     proxyto => 'node',
 216     protected => 1, # qemu pid files are only readable by root
 217     parameters => {
 218         additionalProperties => 0,
 219         properties => {
 220             node => get_standard_option('pve-node'),
 221         },
 222     },
 223     returns => {
 224         type => 'array',
 225         items => {
 226             type => "object",
 227             properties => {},
 228         },
 229         links => [ { rel => 'child', href => "{vmid}" } ],
 230     },
 231     code => sub {
 232         my ($param) = @_;
 233
 234         my $rpcenv = PVE::RPCEnvironment::get();
 235         my $authuser = $rpcenv->get_user();
 236
 237         my $vmstatus = PVE::QemuServer::vmstatus();
 238
 239         my $res = [];
 240         foreach my $vmid (keys %$vmstatus) {
 241             next if !$rpcenv->check($authuser, "/vms/$vmid", [ 'VM.Audit' ], 1);
 242
 243             my $data = $vmstatus->{$vmid};
 244             $data->{vmid} = $vmid;
 245             push @$res, $data;
 246         }
 247
 248         return $res;
 249     }});
 250
 251
 252
 253 __PACKAGE__->register_method({
 254     name => 'create_vm',
 255     path => '',
 256     method => 'POST',
 257     description => "Create or restore a virtual machine.",
 258     permissions => {
 259         description => "You need 'VM.Allocate' permissions on /vms/{vmid} or on the VM pool /pool/{pool}. " .
 260             "For restore (option 'archive'), it is enough if the user has 'VM.Backup' permission and the VM already exists. " .
 261             "If you create disks you need 'Datastore.AllocateSpace' on any used storage.",
 262         user => 'all', # check inside
 263     },
 264     protected => 1,
 265     proxyto => 'node',
 266     parameters => {
 267         additionalProperties => 0,
 268         properties => PVE::QemuServer::json_config_properties(
 269             {
 270                 node => get_standard_option('pve-node'),
 271                 vmid => get_standard_option('pve-vmid'),
 272                 archive => {
 273                     description => "The backup file.",
 274                     type => 'string',
 275                     optional => 1,
 276                     maxLength => 255,
 277                 },
 278                 storage => get_standard_option('pve-storage-id', {
 279                     description => "Default storage.",
 280                     optional => 1,
 281                 }),
 282                 force => {
 283                     optional => 1,
 284                     type => 'boolean',
 285                     description => "Allow to overwrite existing VM.",
 286                     requires => 'archive',
 287                 },
 288                 unique => {
 289                     optional => 1,
 290                     type => 'boolean',
 291                     description => "Assign a unique random ethernet address.",
 292                     requires => 'archive',
 293                 },
 294                 pool => {
 295                     optional => 1,
 296                     type => 'string', format => 'pve-poolid',
 297                     description => "Add the VM to the specified pool.",
 298                 },
 299             }),
 300     },
 301     returns => {
 302         type => 'string',
 303     },
 304     code => sub {
 305         my ($param) = @_;
 306
 307         my $rpcenv = PVE::RPCEnvironment::get();
 308
 309         my $authuser = $rpcenv->get_user();
 310
 311         my $node = extract_param($param, 'node');
 312
 313         my $vmid = extract_param($param, 'vmid');
 314
 315         my $archive = extract_param($param, 'archive');
 316
 317         my $storage = extract_param($param, 'storage');
 318
 319         my $force = extract_param($param, 'force');
 320
 321         my $unique = extract_param($param, 'unique');
 322
 323         my $pool = extract_param($param, 'pool');
 324
 325         my $filename = PVE::QemuServer::config_file($vmid);
 326
 327         my $storecfg = PVE::Storage::config();
 328
 329         PVE::Cluster::check_cfs_quorum();
 330
 331         if (defined($pool)) {
 332             $rpcenv->check_pool_exist($pool);
 333         }
 334
 335         $rpcenv->check($authuser, "/storage/$storage", ['Datastore.AllocateSpace'])
 336             if defined($storage);
 337
 338         if ($rpcenv->check($authuser, "/vms/$vmid", ['VM.Allocate'], 1)) {
 339             # OK
 340         } elsif ($pool && $rpcenv->check($authuser, "/pool/$pool", ['VM.Allocate'], 1)) {
 341             # OK
 342         } elsif ($archive && $force && (-f $filename) &&
 343                  $rpcenv->check($authuser, "/vms/$vmid", ['VM.Backup'], 1)) {
 344             # OK: user has VM.Backup permissions, and want to restore an existing VM
 345         } else {
 346             raise_perm_exc();
 347         }
 348
 349         if (!$archive) {
 350             &$resolve_cdrom_alias($param);
 351
 352             &$check_storage_access($rpcenv, $authuser, $storecfg, $vmid, $param, $storage);
 353
 354             &$check_vm_modify_config_perm($rpcenv, $authuser, $vmid, $pool, [ keys %$param]);
 355
 356             foreach my $opt (keys %$param) {
 357                 if (PVE::QemuServer::valid_drivename($opt)) {
 358                     my $drive = PVE::QemuServer::parse_drive($opt, $param->{$opt});
 359                     raise_param_exc({ $opt => "unable to parse drive options" }) if !$drive;
 360
 361                     PVE::QemuServer::cleanup_drive_path($opt, $storecfg, $drive);
 362                     $param->{$opt} = PVE::QemuServer::print_drive($vmid, $drive);
 363                 }
 364             }
 365
 366             PVE::QemuServer::add_random_macs($param);
 367         } else {
 368             my $keystr = join(' ', keys %$param);
 369             raise_param_exc({ archive => "option conflicts with other options ($keystr)"}) if $keystr;
 370
 371             if ($archive eq '-') {
 372                 die "pipe requires cli environment\n"
 373                     if $rpcenv->{type} ne 'cli';
 374             } else {
 375                 my $path = $rpcenv->check_volume_access($authuser, $storecfg, $vmid, $archive);
 376
 377                 PVE::Storage::activate_volumes($storecfg, [ $archive ])
 378                     if PVE::Storage::parse_volume_id ($archive, 1);
 379
 380                 die "can't find archive file '$archive'\n" if !($path && -f $path);
 381                 $archive = $path;
 382             }
 383         }
 384
 385         my $restorefn = sub {
 386
 387             # fixme: this test does not work if VM exists on other node!
 388             if (-f $filename) {
 389                 die "unable to restore vm $vmid: config file already exists\n"
 390                     if !$force;
 391
 392                 die "unable to restore vm $vmid: vm is running\n"
 393                     if PVE::QemuServer::check_running($vmid);
 394             }
 395
 396             my $realcmd = sub {
 397                 PVE::QemuServer::restore_archive($archive, $vmid, $authuser, {
 398                     storage => $storage,
 399                     pool => $pool,
 400                     unique => $unique });
 401
 402                 PVE::AccessControl::add_vm_to_pool($vmid, $pool) if $pool;
 403             };
 404
 405             return $rpcenv->fork_worker('qmrestore', $vmid, $authuser, $realcmd);
 406         };
 407
 408         my $createfn = sub {
 409
 410             # test after locking
 411             die "unable to create vm $vmid: config file already exists\n"
 412                 if -f $filename;
 413
 414             my $realcmd = sub {
 415
 416                 my $vollist = [];
 417
 418                 my $conf = $param;
 419
 420                 eval {
 421
 422                     $vollist = &$create_disks($rpcenv, $authuser, $conf, $storecfg, $vmid, $pool, $param, $storage);
 423
 424                     # try to be smart about bootdisk
 425                     my @disks = PVE::QemuServer::disknames();
 426                     my $firstdisk;
 427                     foreach my $ds (reverse @disks) {
 428                         next if !$conf->{$ds};
 429                         my $disk = PVE::QemuServer::parse_drive($ds, $conf->{$ds});
 430                         next if PVE::QemuServer::drive_is_cdrom($disk);
 431                         $firstdisk = $ds;
 432                     }
 433
 434                     if (!$conf->{bootdisk} && $firstdisk) {
 435                         $conf->{bootdisk} = $firstdisk;
 436                     }
 437
 438                     PVE::QemuServer::update_config_nolock($vmid, $conf);
 439
 440                 };
 441                 my $err = $@;
 442
 443                 if ($err) {
 444                     foreach my $volid (@$vollist) {
 445                         eval { PVE::Storage::vdisk_free($storecfg, $volid); };
 446                         warn $@ if $@;
 447                     }
 448                     die "create failed - $err";
 449                 }
 450
 451                 PVE::AccessControl::add_vm_to_pool($vmid, $pool) if $pool;
 452             };
 453
 454             return $rpcenv->fork_worker('qmcreate', $vmid, $authuser, $realcmd);
 455         };
 456
 457         return PVE::QemuServer::lock_config_full($vmid, 1, $archive ? $restorefn : $createfn);
 458     }});
 459
 460 __PACKAGE__->register_method({
 461     name => 'vmdiridx',
 462     path => '{vmid}',
 463     method => 'GET',
 464     proxyto => 'node',
 465     description => "Directory index",
 466     permissions => {
 467         user => 'all',
 468     },
 469     parameters => {
 470         additionalProperties => 0,
 471         properties => {
 472             node => get_standard_option('pve-node'),
 473             vmid => get_standard_option('pve-vmid'),
 474         },
 475     },
 476     returns => {
 477         type => 'array',
 478         items => {
 479             type => "object",
 480             properties => {
 481                 subdir => { type => 'string' },
 482             },
 483         },
 484         links => [ { rel => 'child', href => "{subdir}" } ],
 485     },
 486     code => sub {
 487         my ($param) = @_;
 488
 489         my $res = [
 490             { subdir => 'config' },
 491             { subdir => 'status' },
 492             { subdir => 'unlink' },
 493             { subdir => 'vncproxy' },
 494             { subdir => 'migrate' },
 495             { subdir => 'resize' },
 496             { subdir => 'rrd' },
 497             { subdir => 'rrddata' },
 498             { subdir => 'monitor' },
 499             { subdir => 'snapshot' },
 500             ];
 501
 502         return $res;
 503     }});
 504
 505 __PACKAGE__->register_method({
 506     name => 'rrd',
 507     path => '{vmid}/rrd',
 508     method => 'GET',
 509     protected => 1, # fixme: can we avoid that?
 510     permissions => {
 511         check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
 512     },
 513     description => "Read VM RRD statistics (returns PNG)",
 514     parameters => {
 515         additionalProperties => 0,
 516         properties => {
 517             node => get_standard_option('pve-node'),
 518             vmid => get_standard_option('pve-vmid'),
 519             timeframe => {
 520                 description => "Specify the time frame you are interested in.",
 521                 type => 'string',
 522                 enum => [ 'hour', 'day', 'week', 'month', 'year' ],
 523             },
 524             ds => {
 525                 description => "The list of datasources you want to display.",
 526                 type => 'string', format => 'pve-configid-list',
 527             },
 528             cf => {
 529                 description => "The RRD consolidation function",
 530                 type => 'string',
 531                 enum => [ 'AVERAGE', 'MAX' ],
 532                 optional => 1,
 533             },
 534         },
 535     },
 536     returns => {
 537         type => "object",
 538         properties => {
 539             filename => { type => 'string' },
 540         },
 541     },
 542     code => sub {
 543         my ($param) = @_;
 544
 545         return PVE::Cluster::create_rrd_graph(
 546             "pve2-vm/$param->{vmid}", $param->{timeframe},
 547             $param->{ds}, $param->{cf});
 548
 549     }});
 550
 551 __PACKAGE__->register_method({
 552     name => 'rrddata',
 553     path => '{vmid}/rrddata',
 554     method => 'GET',
 555     protected => 1, # fixme: can we avoid that?
 556     permissions => {
 557         check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
 558     },
 559     description => "Read VM RRD statistics",
 560     parameters => {
 561         additionalProperties => 0,
 562         properties => {
 563             node => get_standard_option('pve-node'),
 564             vmid => get_standard_option('pve-vmid'),
 565             timeframe => {
 566                 description => "Specify the time frame you are interested in.",
 567                 type => 'string',
 568                 enum => [ 'hour', 'day', 'week', 'month', 'year' ],
 569             },
 570             cf => {
 571                 description => "The RRD consolidation function",
 572                 type => 'string',
 573                 enum => [ 'AVERAGE', 'MAX' ],
 574                 optional => 1,
 575             },
 576         },
 577     },
 578     returns => {
 579         type => "array",
 580         items => {
 581             type => "object",
 582             properties => {},
 583         },
 584     },
 585     code => sub {
 586         my ($param) = @_;
 587
 588         return PVE::Cluster::create_rrd_data(
 589             "pve2-vm/$param->{vmid}", $param->{timeframe}, $param->{cf});
 590     }});
 591
 592
 593 __PACKAGE__->register_method({
 594     name => 'vm_config',
 595     path => '{vmid}/config',
 596     method => 'GET',
 597     proxyto => 'node',
 598     description => "Get virtual machine configuration.",
 599     permissions => {
 600         check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
 601     },
 602     parameters => {
 603         additionalProperties => 0,
 604         properties => {
 605             node => get_standard_option('pve-node'),
 606             vmid => get_standard_option('pve-vmid'),
 607         },
 608     },
 609     returns => {
 610         type => "object",
 611         properties => {
 612             digest => {
 613                 type => 'string',
 614                 description => 'SHA1 digest of configuration file. This can be used to prevent concurrent modifications.',
 615             }
 616         },
 617     },
 618     code => sub {
 619         my ($param) = @_;
 620
 621         my $conf = PVE::QemuServer::load_config($param->{vmid});
 622
 623         delete $conf->{snapshots};
 624
 625         return $conf;
 626     }});
 627
 628 my $vm_is_volid_owner = sub {
 629     my ($storecfg, $vmid, $volid) =@_;
 630
 631     if ($volid !~  m|^/|) {
 632         my ($path, $owner);
 633         eval { ($path, $owner) = PVE::Storage::path($storecfg, $volid); };
 634         if ($owner && ($owner == $vmid)) {
 635             return 1;
 636         }
 637     }
 638
 639     return undef;
 640 };
 641
 642 my $test_deallocate_drive = sub {
 643     my ($storecfg, $vmid, $key, $drive, $force) = @_;
 644
 645     if (!PVE::QemuServer::drive_is_cdrom($drive)) {
 646         my $volid = $drive->{file};
 647         if (&$vm_is_volid_owner($storecfg, $vmid, $volid)) {
 648             if ($force || $key =~ m/^unused/) {
 649                 my $sid = PVE::Storage::parse_volume_id($volid);
 650                 return $sid;
 651             }
 652         }
 653     }
 654
 655     return undef;
 656 };
 657
 658 my $delete_drive = sub {
 659     my ($conf, $storecfg, $vmid, $key, $drive, $force) = @_;
 660
 661     if (!PVE::QemuServer::drive_is_cdrom($drive)) {
 662         my $volid = $drive->{file};
 663
 664         if (&$vm_is_volid_owner($storecfg, $vmid, $volid)) {
 665             if ($force || $key =~ m/^unused/) {
 666                 eval {
 667                     # check if the disk is really unused
 668                     my $used_paths = PVE::QemuServer::get_used_paths($vmid, $storecfg, $conf, 1, $key);
 669                     my $path = PVE::Storage::path($storecfg, $volid);
 670
 671                     die "unable to delete '$volid' - volume is still in use (snapshot?)\n"
 672                         if $used_paths->{$path};
 673
 674                     PVE::Storage::vdisk_free($storecfg, $volid);
 675                 };
 676                 die $@ if $@;
 677             } else {
 678                 PVE::QemuServer::add_unused_volume($conf, $volid, $vmid);
 679             }
 680         }
 681     }
 682
 683     delete $conf->{$key};
 684 };
 685
 686 my $vmconfig_delete_option = sub {
 687     my ($rpcenv, $authuser, $conf, $storecfg, $vmid, $opt, $force) = @_;
 688
 689     return if !defined($conf->{$opt});
 690
 691     my $isDisk = PVE::QemuServer::valid_drivename($opt)|| ($opt =~ m/^unused/);
 692
 693     if ($isDisk) {
 694         $rpcenv->check_vm_perm($authuser, $vmid, undef, ['VM.Config.Disk']);
 695
 696         my $drive = PVE::QemuServer::parse_drive($opt, $conf->{$opt});
 697         if (my $sid = &$test_deallocate_drive($storecfg, $vmid, $opt, $drive, $force)) {
 698             $rpcenv->check($authuser, "/storage/$sid", ['Datastore.Allocate']);
 699         }
 700     }
 701
 702     my $unplugwarning = "";
 703     if($conf->{ostype} && $conf->{ostype} eq 'l26'){
 704         $unplugwarning = "<br>verify that you have acpiphp && pci_hotplug modules loaded in your guest VM";
 705     }elsif($conf->{ostype} && $conf->{ostype} eq 'l24'){
 706         $unplugwarning = "<br>kernel 2.4 don't support hotplug, please disable hotplug in options";
 707     }elsif(!$conf->{ostype} || ($conf->{ostype} && $conf->{ostype} eq 'other')){
 708         $unplugwarning = "<br>verify that your guest support acpi hotplug";
 709     }
 710
 711     if($opt eq 'tablet'){
 712         PVE::QemuServer::vm_deviceplug(undef, $conf, $vmid, $opt);
 713     }else{
 714         die "error hot-unplug $opt $unplugwarning" if !PVE::QemuServer::vm_deviceunplug($vmid, $conf, $opt);
 715     }
 716
 717     if ($isDisk) {
 718         my $drive = PVE::QemuServer::parse_drive($opt, $conf->{$opt});
 719         &$delete_drive($conf, $storecfg, $vmid, $opt, $drive, $force);
 720     } else {
 721         delete $conf->{$opt};
 722     }
 723
 724     PVE::QemuServer::update_config_nolock($vmid, $conf, 1);
 725 };
 726
 727 my $safe_num_ne = sub {
 728     my ($a, $b) = @_;
 729
 730     return 0 if !defined($a) && !defined($b);
 731     return 1 if !defined($a);
 732     return 1 if !defined($b);
 733
 734     return $a != $b;
 735 };
 736
 737 my $vmconfig_update_disk = sub {
 738     my ($rpcenv, $authuser, $conf, $storecfg, $vmid, $opt, $value, $force) = @_;
 739
 740     my $drive = PVE::QemuServer::parse_drive($opt, $value);
 741
 742     if (PVE::QemuServer::drive_is_cdrom($drive)) { #cdrom
 743         $rpcenv->check_vm_perm($authuser, $vmid, undef, ['VM.Config.CDROM']);
 744     } else {
 745         $rpcenv->check_vm_perm($authuser, $vmid, undef, ['VM.Config.Disk']);
 746     }
 747
 748     if ($conf->{$opt}) {
 749
 750         if (my $old_drive = PVE::QemuServer::parse_drive($opt, $conf->{$opt}))  {
 751
 752             my $media = $drive->{media} || 'disk';
 753             my $oldmedia = $old_drive->{media} || 'disk';
 754             die "unable to change media type\n" if $media ne $oldmedia;
 755
 756             if (!PVE::QemuServer::drive_is_cdrom($old_drive) &&
 757                 ($drive->{file} ne $old_drive->{file})) {  # delete old disks
 758
 759                 &$vmconfig_delete_option($rpcenv, $authuser, $conf, $storecfg, $vmid, $opt, $force);
 760                 $conf = PVE::QemuServer::load_config($vmid); # update/reload
 761             }
 762
 763             if(&$safe_num_ne($drive->{mbps}, $old_drive->{mbps}) ||
 764                &$safe_num_ne($drive->{mbps_rd}, $old_drive->{mbps_rd}) ||
 765                &$safe_num_ne($drive->{mbps_wr}, $old_drive->{mbps_wr}) ||
 766                &$safe_num_ne($drive->{iops}, $old_drive->{iops}) ||
 767                &$safe_num_ne($drive->{iops_rd}, $old_drive->{iops_rd}) ||
 768                &$safe_num_ne($drive->{iops_wr}, $old_drive->{iops_wr})) {
 769                PVE::QemuServer::qemu_block_set_io_throttle($vmid,"drive-$opt", $drive->{mbps}*1024*1024,
 770                                                            $drive->{mbps_rd}*1024*1024, $drive->{mbps_wr}*1024*1024,
 771                                                            $drive->{iops}, $drive->{iops_rd}, $drive->{iops_wr})
 772                    if !PVE::QemuServer::drive_is_cdrom($drive);
 773             }
 774         }
 775     }
 776
 777     &$create_disks($rpcenv, $authuser, $conf, $storecfg, $vmid, undef, {$opt => $value});
 778     PVE::QemuServer::update_config_nolock($vmid, $conf, 1);
 779
 780     $conf = PVE::QemuServer::load_config($vmid); # update/reload
 781     $drive = PVE::QemuServer::parse_drive($opt, $conf->{$opt});
 782
 783     if (PVE::QemuServer::drive_is_cdrom($drive)) { # cdrom
 784
 785         if (PVE::QemuServer::check_running($vmid)) {
 786             if ($drive->{file} eq 'none') {
 787                 PVE::QemuServer::vm_mon_cmd($vmid, "eject",force => JSON::true,device => "drive-$opt");
 788             } else {
 789                 my $path = PVE::QemuServer::get_iso_path($storecfg, $vmid, $drive->{file});
 790                 PVE::QemuServer::vm_mon_cmd($vmid, "eject",force => JSON::true,device => "drive-$opt"); #force eject if locked
 791                 PVE::QemuServer::vm_mon_cmd($vmid, "change",device => "drive-$opt",target => "$path") if $path;
 792             }
 793         }
 794
 795     } else { # hotplug new disks
 796
 797         die "error hotplug $opt" if !PVE::QemuServer::vm_deviceplug($storecfg, $conf, $vmid, $opt, $drive);
 798     }
 799 };
 800
 801 my $vmconfig_update_net = sub {
 802     my ($rpcenv, $authuser, $conf, $storecfg, $vmid, $opt, $value) = @_;
 803
 804     if ($conf->{$opt} && PVE::QemuServer::check_running($vmid)) {
 805         my $oldnet = PVE::QemuServer::parse_net($conf->{$opt});
 806         my $newnet = PVE::QemuServer::parse_net($value);
 807
 808         if($oldnet->{model} ne $newnet->{model}){
 809             #if model change, we try to hot-unplug
 810             die "error hot-unplug $opt for update" if !PVE::QemuServer::vm_deviceunplug($vmid, $conf, $opt);
 811         }else{
 812
 813             if($newnet->{bridge} && $oldnet->{bridge}){
 814                 my $iface = "tap".$vmid."i".$1 if $opt =~ m/net(\d+)/;
 815
 816                 if($newnet->{rate} ne $oldnet->{rate}){
 817                     PVE::Network::tap_rate_limit($iface, $newnet->{rate});
 818                 }
 819
 820                 if(($newnet->{bridge} ne $oldnet->{bridge}) || ($newnet->{tag} ne $oldnet->{tag})){
 821                     eval{PVE::Network::tap_unplug($iface, $oldnet->{bridge}, $oldnet->{tag});};
 822                     PVE::Network::tap_plug($iface, $newnet->{bridge}, $newnet->{tag});
 823                 }
 824
 825             }else{
 826                 #if bridge/nat mode change, we try to hot-unplug
 827                 die "error hot-unplug $opt for update" if !PVE::QemuServer::vm_deviceunplug($vmid, $conf, $opt);
 828             }
 829         }
 830
 831     }
 832     $conf->{$opt} = $value;
 833     PVE::QemuServer::update_config_nolock($vmid, $conf, 1);
 834     $conf = PVE::QemuServer::load_config($vmid); # update/reload
 835
 836     my $net = PVE::QemuServer::parse_net($conf->{$opt});
 837
 838     die "error hotplug $opt" if !PVE::QemuServer::vm_deviceplug($storecfg, $conf, $vmid, $opt, $net);
 839 };
 840
 841 my $vm_config_perm_list = [
 842             'VM.Config.Disk',
 843             'VM.Config.CDROM',
 844             'VM.Config.CPU',
 845             'VM.Config.Memory',
 846             'VM.Config.Network',
 847             'VM.Config.HWType',
 848             'VM.Config.Options',
 849     ];
 850
 851 __PACKAGE__->register_method({
 852     name => 'update_vm',
 853     path => '{vmid}/config',
 854     method => 'PUT',
 855     protected => 1,
 856     proxyto => 'node',
 857     description => "Set virtual machine options.",
 858     permissions => {
 859         check => ['perm', '/vms/{vmid}', $vm_config_perm_list, any => 1],
 860     },
 861     parameters => {
 862         additionalProperties => 0,
 863         properties => PVE::QemuServer::json_config_properties(
 864             {
 865                 node => get_standard_option('pve-node'),
 866                 vmid => get_standard_option('pve-vmid'),
 867                 skiplock => get_standard_option('skiplock'),
 868                 delete => {
 869                     type => 'string', format => 'pve-configid-list',
 870                     description => "A list of settings you want to delete.",
 871                     optional => 1,
 872                 },
 873                 force => {
 874                     type => 'boolean',
 875                     description => $opt_force_description,
 876                     optional => 1,
 877                     requires => 'delete',
 878                 },
 879                 digest => {
 880                     type => 'string',
 881                     description => 'Prevent changes if current configuration file has different SHA1 digest. This can be used to prevent concurrent modifications.',
 882                     maxLength => 40,
 883                     optional => 1,
 884                 }
 885             }),
 886     },
 887     returns => { type => 'null'},
 888     code => sub {
 889         my ($param) = @_;
 890
 891         my $rpcenv = PVE::RPCEnvironment::get();
 892
 893         my $authuser = $rpcenv->get_user();
 894
 895         my $node = extract_param($param, 'node');
 896
 897         my $vmid = extract_param($param, 'vmid');
 898
 899         my $digest = extract_param($param, 'digest');
 900
 901         my @paramarr = (); # used for log message
 902         foreach my $key (keys %$param) {
 903             push @paramarr, "-$key", $param->{$key};
 904         }
 905
 906         my $skiplock = extract_param($param, 'skiplock');
 907         raise_param_exc({ skiplock => "Only root may use this option." })
 908             if $skiplock && $authuser ne 'root@pam';
 909
 910         my $delete_str = extract_param($param, 'delete');
 911
 912         my $force = extract_param($param, 'force');
 913
 914         die "no options specified\n" if !$delete_str && !scalar(keys %$param);
 915
 916         my $storecfg = PVE::Storage::config();
 917
 918         my $defaults = PVE::QemuServer::load_defaults();
 919
 920         &$resolve_cdrom_alias($param);
 921
 922         # now try to verify all parameters
 923
 924         my @delete = ();
 925         foreach my $opt (PVE::Tools::split_list($delete_str)) {
 926             $opt = 'ide2' if $opt eq 'cdrom';
 927             raise_param_exc({ delete => "you can't use '-$opt' and " .
 928                                   "-delete $opt' at the same time" })
 929                 if defined($param->{$opt});
 930
 931             if (!PVE::QemuServer::option_exists($opt)) {
 932                 raise_param_exc({ delete => "unknown option '$opt'" });
 933             }
 934
 935             push @delete, $opt;
 936         }
 937
 938         foreach my $opt (keys %$param) {
 939             if (PVE::QemuServer::valid_drivename($opt)) {
 940                 # cleanup drive path
 941                 my $drive = PVE::QemuServer::parse_drive($opt, $param->{$opt});
 942                 PVE::QemuServer::cleanup_drive_path($opt, $storecfg, $drive);
 943                 $param->{$opt} = PVE::QemuServer::print_drive($vmid, $drive);
 944             } elsif ($opt =~ m/^net(\d+)$/) {
 945                 # add macaddr
 946                 my $net = PVE::QemuServer::parse_net($param->{$opt});
 947                 $param->{$opt} = PVE::QemuServer::print_net($net);
 948             }
 949         }
 950
 951         &$check_vm_modify_config_perm($rpcenv, $authuser, $vmid, undef, [@delete]);
 952
 953         &$check_vm_modify_config_perm($rpcenv, $authuser, $vmid, undef, [keys %$param]);
 954
 955         &$check_storage_access($rpcenv, $authuser, $storecfg, $vmid, $param);
 956
 957         my $updatefn =  sub {
 958
 959             my $conf = PVE::QemuServer::load_config($vmid);
 960
 961             die "checksum missmatch (file change by other user?)\n"
 962                 if $digest && $digest ne $conf->{digest};
 963
 964             PVE::QemuServer::check_lock($conf) if !$skiplock;
 965
 966             if ($param->{memory} || defined($param->{balloon})) {
 967                 my $maxmem = $param->{memory} || $conf->{memory} || $defaults->{memory};
 968                 my $balloon = defined($param->{balloon}) ?  $param->{balloon} : $conf->{balloon};
 969
 970                 die "balloon value too large (must be smaller than assigned memory)\n"
 971                     if $balloon && $balloon > $maxmem;
 972             }
 973
 974             PVE::Cluster::log_msg('info', $authuser, "update VM $vmid: " . join (' ', @paramarr));
 975
 976             foreach my $opt (@delete) { # delete
 977                 $conf = PVE::QemuServer::load_config($vmid); # update/reload
 978                 &$vmconfig_delete_option($rpcenv, $authuser, $conf, $storecfg, $vmid, $opt, $force);
 979             }
 980
 981             my $running = PVE::QemuServer::check_running($vmid);
 982
 983             foreach my $opt (keys %$param) { # add/change
 984
 985                 $conf = PVE::QemuServer::load_config($vmid); # update/reload
 986
 987                 next if $conf->{$opt} && ($param->{$opt} eq $conf->{$opt}); # skip if nothing changed
 988
 989                 if (PVE::QemuServer::valid_drivename($opt)) {
 990
 991                     &$vmconfig_update_disk($rpcenv, $authuser, $conf, $storecfg, $vmid,
 992                                            $opt, $param->{$opt}, $force);
 993
 994                 } elsif ($opt =~ m/^net(\d+)$/) { #nics
 995
 996                     &$vmconfig_update_net($rpcenv, $authuser, $conf, $storecfg, $vmid,
 997                                           $opt, $param->{$opt});
 998
 999                 } else {
1000
1001                     if($opt eq 'tablet' && $param->{$opt} == 1){
1002                         PVE::QemuServer::vm_deviceplug(undef, $conf, $vmid, $opt);
1003                     }elsif($opt eq 'tablet' && $param->{$opt} == 0){
1004                         PVE::QemuServer::vm_deviceunplug($vmid, $conf, $opt);
1005                     }
1006
1007                     $conf->{$opt} = $param->{$opt};
1008                     PVE::QemuServer::update_config_nolock($vmid, $conf, 1);
1009                 }
1010             }
1011
1012             # allow manual ballooning if shares is set to zero
1013             if ($running && defined($param->{balloon}) &&
1014                 defined($conf->{shares}) && ($conf->{shares} == 0)) {
1015                 my $balloon = $param->{'balloon'} || $conf->{memory} || $defaults->{memory};
1016                 PVE::QemuServer::vm_mon_cmd($vmid, "balloon", value => $balloon*1024*1024);
1017             }
1018
1019         };
1020
1021         PVE::QemuServer::lock_config($vmid, $updatefn);
1022
1023         return undef;
1024     }});
1025
1026
1027 __PACKAGE__->register_method({
1028     name => 'destroy_vm',
1029     path => '{vmid}',
1030     method => 'DELETE',
1031     protected => 1,
1032     proxyto => 'node',
1033     description => "Destroy the vm (also delete all used/owned volumes).",
1034     permissions => {
1035         check => [ 'perm', '/vms/{vmid}', ['VM.Allocate']],
1036     },
1037     parameters => {
1038         additionalProperties => 0,
1039         properties => {
1040             node => get_standard_option('pve-node'),
1041             vmid => get_standard_option('pve-vmid'),
1042             skiplock => get_standard_option('skiplock'),
1043         },
1044     },
1045     returns => {
1046         type => 'string',
1047     },
1048     code => sub {
1049         my ($param) = @_;
1050
1051         my $rpcenv = PVE::RPCEnvironment::get();
1052
1053         my $authuser = $rpcenv->get_user();
1054
1055         my $vmid = $param->{vmid};
1056
1057         my $skiplock = $param->{skiplock};
1058         raise_param_exc({ skiplock => "Only root may use this option." })
1059             if $skiplock && $authuser ne 'root@pam';
1060
1061         # test if VM exists
1062         my $conf = PVE::QemuServer::load_config($vmid);
1063
1064         my $storecfg = PVE::Storage::config();
1065
1066         my $delVMfromPoolFn = sub {
1067             my $usercfg = cfs_read_file("user.cfg");
1068             if (my $pool = $usercfg->{vms}->{$vmid}) {
1069                 if (my $data = $usercfg->{pools}->{$pool}) {
1070                     delete $data->{vms}->{$vmid};
1071                     delete $usercfg->{vms}->{$vmid};
1072                     cfs_write_file("user.cfg", $usercfg);
1073                 }
1074             }
1075         };
1076
1077         my $realcmd = sub {
1078             my $upid = shift;
1079
1080             syslog('info', "destroy VM $vmid: $upid\n");
1081
1082             PVE::QemuServer::vm_destroy($storecfg, $vmid, $skiplock);
1083
1084             PVE::AccessControl::remove_vm_from_pool($vmid);
1085         };
1086
1087         return $rpcenv->fork_worker('qmdestroy', $vmid, $authuser, $realcmd);
1088     }});
1089
1090 __PACKAGE__->register_method({
1091     name => 'unlink',
1092     path => '{vmid}/unlink',
1093     method => 'PUT',
1094     protected => 1,
1095     proxyto => 'node',
1096     description => "Unlink/delete disk images.",
1097     permissions => {
1098         check => [ 'perm', '/vms/{vmid}', ['VM.Config.Disk']],
1099     },
1100     parameters => {
1101         additionalProperties => 0,
1102         properties => {
1103             node => get_standard_option('pve-node'),
1104             vmid => get_standard_option('pve-vmid'),
1105             idlist => {
1106                 type => 'string', format => 'pve-configid-list',
1107                 description => "A list of disk IDs you want to delete.",
1108             },
1109             force => {
1110                 type => 'boolean',
1111                 description => $opt_force_description,
1112                 optional => 1,
1113             },
1114         },
1115     },
1116     returns => { type => 'null'},
1117     code => sub {
1118         my ($param) = @_;
1119
1120         $param->{delete} = extract_param($param, 'idlist');
1121
1122         __PACKAGE__->update_vm($param);
1123
1124         return undef;
1125     }});
1126
1127 my $sslcert;
1128
1129 __PACKAGE__->register_method({
1130     name => 'vncproxy',
1131     path => '{vmid}/vncproxy',
1132     method => 'POST',
1133     protected => 1,
1134     permissions => {
1135         check => ['perm', '/vms/{vmid}', [ 'VM.Console' ]],
1136     },
1137     description => "Creates a TCP VNC proxy connections.",
1138     parameters => {
1139         additionalProperties => 0,
1140         properties => {
1141             node => get_standard_option('pve-node'),
1142             vmid => get_standard_option('pve-vmid'),
1143         },
1144     },
1145     returns => {
1146         additionalProperties => 0,
1147         properties => {
1148             user => { type => 'string' },
1149             ticket => { type => 'string' },
1150             cert => { type => 'string' },
1151             port => { type => 'integer' },
1152             upid => { type => 'string' },
1153         },
1154     },
1155     code => sub {
1156         my ($param) = @_;
1157
1158         my $rpcenv = PVE::RPCEnvironment::get();
1159
1160         my $authuser = $rpcenv->get_user();
1161
1162         my $vmid = $param->{vmid};
1163         my $node = $param->{node};
1164
1165         my $authpath = "/vms/$vmid";
1166
1167         my $ticket = PVE::AccessControl::assemble_vnc_ticket($authuser, $authpath);
1168
1169         $sslcert = PVE::Tools::file_get_contents("/etc/pve/pve-root-ca.pem", 8192)
1170             if !$sslcert;
1171
1172         my $port = PVE::Tools::next_vnc_port();
1173
1174         my $remip;
1175
1176         if ($node ne 'localhost' && $node ne PVE::INotify::nodename()) {
1177             $remip = PVE::Cluster::remote_node_ip($node);
1178         }
1179
1180         # NOTE: kvm VNC traffic is already TLS encrypted
1181         my $remcmd = $remip ? ['/usr/bin/ssh', '-T', '-o', 'BatchMode=yes', $remip] : [];
1182
1183         my $timeout = 10;
1184
1185         my $realcmd = sub {
1186             my $upid = shift;
1187
1188             syslog('info', "starting vnc proxy $upid\n");
1189
1190             my $qmcmd = [@$remcmd, "/usr/sbin/qm", 'vncproxy', $vmid];
1191
1192             my $qmstr = join(' ', @$qmcmd);
1193
1194             # also redirect stderr (else we get RFB protocol errors)
1195             my $cmd = ['/bin/nc', '-l', '-p', $port, '-w', $timeout, '-c', "$qmstr 2>/dev/null"];
1196
1197             PVE::Tools::run_command($cmd);
1198
1199             return;
1200         };
1201
1202         my $upid = $rpcenv->fork_worker('vncproxy', $vmid, $authuser, $realcmd);
1203
1204         PVE::Tools::wait_for_vnc_port($port);
1205
1206         return {
1207             user => $authuser,
1208             ticket => $ticket,
1209             port => $port,
1210             upid => $upid,
1211             cert => $sslcert,
1212         };
1213     }});
1214
1215 __PACKAGE__->register_method({
1216     name => 'vmcmdidx',
1217     path => '{vmid}/status',
1218     method => 'GET',
1219     proxyto => 'node',
1220     description => "Directory index",
1221     permissions => {
1222         user => 'all',
1223     },
1224     parameters => {
1225         additionalProperties => 0,
1226         properties => {
1227             node => get_standard_option('pve-node'),
1228             vmid => get_standard_option('pve-vmid'),
1229         },
1230     },
1231     returns => {
1232         type => 'array',
1233         items => {
1234             type => "object",
1235             properties => {
1236                 subdir => { type => 'string' },
1237             },
1238         },
1239         links => [ { rel => 'child', href => "{subdir}" } ],
1240     },
1241     code => sub {
1242         my ($param) = @_;
1243
1244         # test if VM exists
1245         my $conf = PVE::QemuServer::load_config($param->{vmid});
1246
1247         my $res = [
1248             { subdir => 'current' },
1249             { subdir => 'start' },
1250             { subdir => 'stop' },
1251             ];
1252
1253         return $res;
1254     }});
1255
1256 my $vm_is_ha_managed = sub {
1257     my ($vmid) = @_;
1258
1259     my $cc = PVE::Cluster::cfs_read_file('cluster.conf');
1260     if (PVE::Cluster::cluster_conf_lookup_pvevm($cc, 0, $vmid, 1)) {
1261         return 1;
1262     }
1263     return 0;
1264 };
1265
1266 __PACKAGE__->register_method({
1267     name => 'vm_status',
1268     path => '{vmid}/status/current',
1269     method => 'GET',
1270     proxyto => 'node',
1271     protected => 1, # qemu pid files are only readable by root
1272     description => "Get virtual machine status.",
1273     permissions => {
1274         check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
1275     },
1276     parameters => {
1277         additionalProperties => 0,
1278         properties => {
1279             node => get_standard_option('pve-node'),
1280             vmid => get_standard_option('pve-vmid'),
1281         },
1282     },
1283     returns => { type => 'object' },
1284     code => sub {
1285         my ($param) = @_;
1286
1287         # test if VM exists
1288         my $conf = PVE::QemuServer::load_config($param->{vmid});
1289
1290         my $vmstatus = PVE::QemuServer::vmstatus($param->{vmid}, 1);
1291         my $status = $vmstatus->{$param->{vmid}};
1292
1293         $status->{ha} = &$vm_is_ha_managed($param->{vmid});
1294
1295         return $status;
1296     }});
1297
1298 __PACKAGE__->register_method({
1299     name => 'vm_start',
1300     path => '{vmid}/status/start',
1301     method => 'POST',
1302     protected => 1,
1303     proxyto => 'node',
1304     description => "Start virtual machine.",
1305     permissions => {
1306         check => ['perm', '/vms/{vmid}', [ 'VM.PowerMgmt' ]],
1307     },
1308     parameters => {
1309         additionalProperties => 0,
1310         properties => {
1311             node => get_standard_option('pve-node'),
1312             vmid => get_standard_option('pve-vmid'),
1313             skiplock => get_standard_option('skiplock'),
1314             stateuri => get_standard_option('pve-qm-stateuri'),
1315             migratedfrom => get_standard_option('pve-node',{ optional => 1 }),
1316
1317         },
1318     },
1319     returns => {
1320         type => 'string',
1321     },
1322     code => sub {
1323         my ($param) = @_;
1324
1325         my $rpcenv = PVE::RPCEnvironment::get();
1326
1327         my $authuser = $rpcenv->get_user();
1328
1329         my $node = extract_param($param, 'node');
1330
1331         my $vmid = extract_param($param, 'vmid');
1332
1333         my $stateuri = extract_param($param, 'stateuri');
1334         raise_param_exc({ stateuri => "Only root may use this option." })
1335             if $stateuri && $authuser ne 'root@pam';
1336
1337         my $skiplock = extract_param($param, 'skiplock');
1338         raise_param_exc({ skiplock => "Only root may use this option." })
1339             if $skiplock && $authuser ne 'root@pam';
1340
1341         my $migratedfrom = extract_param($param, 'migratedfrom');
1342         raise_param_exc({ migratedfrom => "Only root may use this option." })
1343             if $migratedfrom && $authuser ne 'root@pam';
1344
1345         my $storecfg = PVE::Storage::config();
1346
1347         if (&$vm_is_ha_managed($vmid) && !$stateuri &&
1348             $rpcenv->{type} ne 'ha') {
1349
1350             my $hacmd = sub {
1351                 my $upid = shift;
1352
1353                 my $service = "pvevm:$vmid";
1354
1355                 my $cmd = ['clusvcadm', '-e', $service, '-m', $node];
1356
1357                 print "Executing HA start for VM $vmid\n";
1358
1359                 PVE::Tools::run_command($cmd);
1360
1361                 return;
1362             };
1363
1364             return $rpcenv->fork_worker('hastart', $vmid, $authuser, $hacmd);
1365
1366         } else {
1367
1368             my $realcmd = sub {
1369                 my $upid = shift;
1370
1371                 syslog('info', "start VM $vmid: $upid\n");
1372
1373                 PVE::QemuServer::vm_start($storecfg, $vmid, $stateuri, $skiplock, $migratedfrom);
1374
1375                 return;
1376             };
1377
1378             return $rpcenv->fork_worker('qmstart', $vmid, $authuser, $realcmd);
1379         }
1380     }});
1381
1382 __PACKAGE__->register_method({
1383     name => 'vm_stop',
1384     path => '{vmid}/status/stop',
1385     method => 'POST',
1386     protected => 1,
1387     proxyto => 'node',
1388     description => "Stop virtual machine.",
1389     permissions => {
1390         check => ['perm', '/vms/{vmid}', [ 'VM.PowerMgmt' ]],
1391     },
1392     parameters => {
1393         additionalProperties => 0,
1394         properties => {
1395             node => get_standard_option('pve-node'),
1396             vmid => get_standard_option('pve-vmid'),
1397             skiplock => get_standard_option('skiplock'),
1398             migratedfrom => get_standard_option('pve-node',{ optional => 1 }),
1399             timeout => {
1400                 description => "Wait maximal timeout seconds.",
1401                 type => 'integer',
1402                 minimum => 0,
1403                 optional => 1,
1404             },
1405             keepActive => {
1406                 description => "Do not decativate storage volumes.",
1407                 type => 'boolean',
1408                 optional => 1,
1409                 default => 0,
1410             }
1411         },
1412     },
1413     returns => {
1414         type => 'string',
1415     },
1416     code => sub {
1417         my ($param) = @_;
1418
1419         my $rpcenv = PVE::RPCEnvironment::get();
1420
1421         my $authuser = $rpcenv->get_user();
1422
1423         my $node = extract_param($param, 'node');
1424
1425         my $vmid = extract_param($param, 'vmid');
1426
1427         my $skiplock = extract_param($param, 'skiplock');
1428         raise_param_exc({ skiplock => "Only root may use this option." })
1429             if $skiplock && $authuser ne 'root@pam';
1430
1431         my $keepActive = extract_param($param, 'keepActive');
1432         raise_param_exc({ keepActive => "Only root may use this option." })
1433             if $keepActive && $authuser ne 'root@pam';
1434
1435         my $migratedfrom = extract_param($param, 'migratedfrom');
1436         raise_param_exc({ migratedfrom => "Only root may use this option." })
1437             if $migratedfrom && $authuser ne 'root@pam';
1438
1439
1440         my $storecfg = PVE::Storage::config();
1441
1442         if (&$vm_is_ha_managed($vmid) && $rpcenv->{type} ne 'ha') {
1443
1444             my $hacmd = sub {
1445                 my $upid = shift;
1446
1447                 my $service = "pvevm:$vmid";
1448
1449                 my $cmd = ['clusvcadm', '-d', $service];
1450
1451                 print "Executing HA stop for VM $vmid\n";
1452
1453                 PVE::Tools::run_command($cmd);
1454
1455                 return;
1456             };
1457
1458             return $rpcenv->fork_worker('hastop', $vmid, $authuser, $hacmd);
1459
1460         } else {
1461             my $realcmd = sub {
1462                 my $upid = shift;
1463
1464                 syslog('info', "stop VM $vmid: $upid\n");
1465
1466                 PVE::QemuServer::vm_stop($storecfg, $vmid, $skiplock, 0,
1467                                          $param->{timeout}, 0, 1, $keepActive, $migratedfrom);
1468
1469                 return;
1470             };
1471
1472             return $rpcenv->fork_worker('qmstop', $vmid, $authuser, $realcmd);
1473         }
1474     }});
1475
1476 __PACKAGE__->register_method({
1477     name => 'vm_reset',
1478     path => '{vmid}/status/reset',
1479     method => 'POST',
1480     protected => 1,
1481     proxyto => 'node',
1482     description => "Reset virtual machine.",
1483     permissions => {
1484         check => ['perm', '/vms/{vmid}', [ 'VM.PowerMgmt' ]],
1485     },
1486     parameters => {
1487         additionalProperties => 0,
1488         properties => {
1489             node => get_standard_option('pve-node'),
1490             vmid => get_standard_option('pve-vmid'),
1491             skiplock => get_standard_option('skiplock'),
1492         },
1493     },
1494     returns => {
1495         type => 'string',
1496     },
1497     code => sub {
1498         my ($param) = @_;
1499
1500         my $rpcenv = PVE::RPCEnvironment::get();
1501
1502         my $authuser = $rpcenv->get_user();
1503
1504         my $node = extract_param($param, 'node');
1505
1506         my $vmid = extract_param($param, 'vmid');
1507
1508         my $skiplock = extract_param($param, 'skiplock');
1509         raise_param_exc({ skiplock => "Only root may use this option." })
1510             if $skiplock && $authuser ne 'root@pam';
1511
1512         die "VM $vmid not running\n" if !PVE::QemuServer::check_running($vmid);
1513
1514         my $realcmd = sub {
1515             my $upid = shift;
1516
1517             PVE::QemuServer::vm_reset($vmid, $skiplock);
1518
1519             return;
1520         };
1521
1522         return $rpcenv->fork_worker('qmreset', $vmid, $authuser, $realcmd);
1523     }});
1524
1525 __PACKAGE__->register_method({
1526     name => 'vm_shutdown',
1527     path => '{vmid}/status/shutdown',
1528     method => 'POST',
1529     protected => 1,
1530     proxyto => 'node',
1531     description => "Shutdown virtual machine.",
1532     permissions => {
1533         check => ['perm', '/vms/{vmid}', [ 'VM.PowerMgmt' ]],
1534     },
1535     parameters => {
1536         additionalProperties => 0,
1537         properties => {
1538             node => get_standard_option('pve-node'),
1539             vmid => get_standard_option('pve-vmid'),
1540             skiplock => get_standard_option('skiplock'),
1541             timeout => {
1542                 description => "Wait maximal timeout seconds.",
1543                 type => 'integer',
1544                 minimum => 0,
1545                 optional => 1,
1546             },
1547             forceStop => {
1548                 description => "Make sure the VM stops.",
1549                 type => 'boolean',
1550                 optional => 1,
1551                 default => 0,
1552             },
1553             keepActive => {
1554                 description => "Do not decativate storage volumes.",
1555                 type => 'boolean',
1556                 optional => 1,
1557                 default => 0,
1558             }
1559         },
1560     },
1561     returns => {
1562         type => 'string',
1563     },
1564     code => sub {
1565         my ($param) = @_;
1566
1567         my $rpcenv = PVE::RPCEnvironment::get();
1568
1569         my $authuser = $rpcenv->get_user();
1570
1571         my $node = extract_param($param, 'node');
1572
1573         my $vmid = extract_param($param, 'vmid');
1574
1575         my $skiplock = extract_param($param, 'skiplock');
1576         raise_param_exc({ skiplock => "Only root may use this option." })
1577             if $skiplock && $authuser ne 'root@pam';
1578
1579         my $keepActive = extract_param($param, 'keepActive');
1580         raise_param_exc({ keepActive => "Only root may use this option." })
1581             if $keepActive && $authuser ne 'root@pam';
1582
1583         my $storecfg = PVE::Storage::config();
1584
1585         my $realcmd = sub {
1586             my $upid = shift;
1587
1588             syslog('info', "shutdown VM $vmid: $upid\n");
1589
1590             PVE::QemuServer::vm_stop($storecfg, $vmid, $skiplock, 0, $param->{timeout},
1591                                      1, $param->{forceStop}, $keepActive);
1592
1593             return;
1594         };
1595
1596         return $rpcenv->fork_worker('qmshutdown', $vmid, $authuser, $realcmd);
1597     }});
1598
1599 __PACKAGE__->register_method({
1600     name => 'vm_suspend',
1601     path => '{vmid}/status/suspend',
1602     method => 'POST',
1603     protected => 1,
1604     proxyto => 'node',
1605     description => "Suspend virtual machine.",
1606     permissions => {
1607         check => ['perm', '/vms/{vmid}', [ 'VM.PowerMgmt' ]],
1608     },
1609     parameters => {
1610         additionalProperties => 0,
1611         properties => {
1612             node => get_standard_option('pve-node'),
1613             vmid => get_standard_option('pve-vmid'),
1614             skiplock => get_standard_option('skiplock'),
1615         },
1616     },
1617     returns => {
1618         type => 'string',
1619     },
1620     code => sub {
1621         my ($param) = @_;
1622
1623         my $rpcenv = PVE::RPCEnvironment::get();
1624
1625         my $authuser = $rpcenv->get_user();
1626
1627         my $node = extract_param($param, 'node');
1628
1629         my $vmid = extract_param($param, 'vmid');
1630
1631         my $skiplock = extract_param($param, 'skiplock');
1632         raise_param_exc({ skiplock => "Only root may use this option." })
1633             if $skiplock && $authuser ne 'root@pam';
1634
1635         die "VM $vmid not running\n" if !PVE::QemuServer::check_running($vmid);
1636
1637         my $realcmd = sub {
1638             my $upid = shift;
1639
1640             syslog('info', "suspend VM $vmid: $upid\n");
1641
1642             PVE::QemuServer::vm_suspend($vmid, $skiplock);
1643
1644             return;
1645         };
1646
1647         return $rpcenv->fork_worker('qmsuspend', $vmid, $authuser, $realcmd);
1648     }});
1649
1650 __PACKAGE__->register_method({
1651     name => 'vm_resume',
1652     path => '{vmid}/status/resume',
1653     method => 'POST',
1654     protected => 1,
1655     proxyto => 'node',
1656     description => "Resume virtual machine.",
1657     permissions => {
1658         check => ['perm', '/vms/{vmid}', [ 'VM.PowerMgmt' ]],
1659     },
1660     parameters => {
1661         additionalProperties => 0,
1662         properties => {
1663             node => get_standard_option('pve-node'),
1664             vmid => get_standard_option('pve-vmid'),
1665             skiplock => get_standard_option('skiplock'),
1666         },
1667     },
1668     returns => {
1669         type => 'string',
1670     },
1671     code => sub {
1672         my ($param) = @_;
1673
1674         my $rpcenv = PVE::RPCEnvironment::get();
1675
1676         my $authuser = $rpcenv->get_user();
1677
1678         my $node = extract_param($param, 'node');
1679
1680         my $vmid = extract_param($param, 'vmid');
1681
1682         my $skiplock = extract_param($param, 'skiplock');
1683         raise_param_exc({ skiplock => "Only root may use this option." })
1684             if $skiplock && $authuser ne 'root@pam';
1685
1686         die "VM $vmid not running\n" if !PVE::QemuServer::check_running($vmid);
1687
1688         my $realcmd = sub {
1689             my $upid = shift;
1690
1691             syslog('info', "resume VM $vmid: $upid\n");
1692
1693             PVE::QemuServer::vm_resume($vmid, $skiplock);
1694
1695             return;
1696         };
1697
1698         return $rpcenv->fork_worker('qmresume', $vmid, $authuser, $realcmd);
1699     }});
1700
1701 __PACKAGE__->register_method({
1702     name => 'vm_sendkey',
1703     path => '{vmid}/sendkey',
1704     method => 'PUT',
1705     protected => 1,
1706     proxyto => 'node',
1707     description => "Send key event to virtual machine.",
1708     permissions => {
1709         check => ['perm', '/vms/{vmid}', [ 'VM.Console' ]],
1710     },
1711     parameters => {
1712         additionalProperties => 0,
1713         properties => {
1714             node => get_standard_option('pve-node'),
1715             vmid => get_standard_option('pve-vmid'),
1716             skiplock => get_standard_option('skiplock'),
1717             key => {
1718                 description => "The key (qemu monitor encoding).",
1719                 type => 'string'
1720             }
1721         },
1722     },
1723     returns => { type => 'null'},
1724     code => sub {
1725         my ($param) = @_;
1726
1727         my $rpcenv = PVE::RPCEnvironment::get();
1728
1729         my $authuser = $rpcenv->get_user();
1730
1731         my $node = extract_param($param, 'node');
1732
1733         my $vmid = extract_param($param, 'vmid');
1734
1735         my $skiplock = extract_param($param, 'skiplock');
1736         raise_param_exc({ skiplock => "Only root may use this option." })
1737             if $skiplock && $authuser ne 'root@pam';
1738
1739         PVE::QemuServer::vm_sendkey($vmid, $skiplock, $param->{key});
1740
1741         return;
1742     }});
1743
1744 __PACKAGE__->register_method({
1745     name => 'vm_feature',
1746     path => '{vmid}/feature',
1747     method => 'GET',
1748     proxyto => 'node',
1749     protected => 1,
1750     description => "Check if feature for virtual machine is available.",
1751     permissions => {
1752         check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
1753     },
1754     parameters => {
1755         additionalProperties => 0,
1756         properties => {
1757             node => get_standard_option('pve-node'),
1758             vmid => get_standard_option('pve-vmid'),
1759             feature => {
1760                 description => "Feature to check.",
1761                 type => 'string',
1762                 enum => [ 'snapshot', 'clone', 'copy' ],
1763             },
1764             snapname => get_standard_option('pve-snapshot-name', {
1765                 optional => 1,
1766             }),
1767         },
1768     },
1769     returns => {
1770         type => "object",
1771         properties => {
1772             hasFeature => { type => 'boolean' },
1773             nodes => {
1774                 type => 'array',
1775                 items => { type => 'string' },
1776             }
1777         },
1778     },
1779     code => sub {
1780         my ($param) = @_;
1781
1782         my $node = extract_param($param, 'node');
1783
1784         my $vmid = extract_param($param, 'vmid');
1785
1786         my $snapname = extract_param($param, 'snapname');
1787
1788         my $feature = extract_param($param, 'feature');
1789
1790         my $running = PVE::QemuServer::check_running($vmid);
1791
1792         my $conf = PVE::QemuServer::load_config($vmid);
1793
1794         if($snapname){
1795             my $snap = $conf->{snapshots}->{$snapname};
1796             die "snapshot '$snapname' does not exist\n" if !defined($snap);
1797             $conf = $snap;
1798         }
1799         my $storecfg = PVE::Storage::config();
1800
1801         my $nodelist = PVE::QemuServer::shared_nodes($conf, $storecfg);
1802         my $hasFeature = PVE::QemuServer::has_feature($feature, $conf, $storecfg, $snapname, $running);
1803
1804         return {
1805             hasFeature => $hasFeature,
1806             nodes => [ keys %$nodelist ],
1807         };
1808     }});
1809
1810 __PACKAGE__->register_method({
1811     name => 'clone_vm',
1812     path => '{vmid}/clone',
1813     method => 'POST',
1814     protected => 1,
1815     proxyto => 'node',
1816     description => "Create a copy of virtual machine/template.",
1817     permissions => {
1818         description => "You need 'VM.Clone' permissions on /vms/{vmid}, and 'VM.Allocate' permissions " .
1819             "on /vms/{newid} (or on the VM pool /pool/{pool}). You also need " .
1820             "'Datastore.AllocateSpace' on any used storage.",
1821         check =>
1822         [ 'and',
1823           ['perm', '/vms/{vmid}', [ 'VM.Clone' ]],
1824           [ 'or',
1825             [ 'perm', '/vms/{newid}', ['VM.Allocate']],
1826             [ 'perm', '/pool/{pool}', ['VM.Allocate'], require_param => 'pool'],
1827           ],
1828         ]
1829     },
1830     parameters => {
1831         additionalProperties => 0,
1832         properties => {
1833             node => get_standard_option('pve-node'),
1834             vmid => get_standard_option('pve-vmid'),
1835             newid => get_standard_option('pve-vmid', { description => 'VMID for the clone.' }),
1836             name => {
1837                 optional => 1,
1838                 type => 'string', format => 'dns-name',
1839                 description => "Set a name for the new VM.",
1840             },
1841             description => {
1842                 optional => 1,
1843                 type => 'string',
1844                 description => "Description for the new VM.",
1845             },
1846             pool => {
1847                 optional => 1,
1848                 type => 'string', format => 'pve-poolid',
1849                 description => "Add the new VM to the specified pool.",
1850             },
1851             snapname => get_standard_option('pve-snapshot-name', {
1852                 requires => 'full',
1853                 optional => 1,
1854             }),
1855             storage => get_standard_option('pve-storage-id', {
1856                 description => "Target storage for full clone.",
1857                 requires => 'full',
1858                 optional => 1,
1859             }),
1860             'format' => {
1861                 description => "Target format for file storage.",
1862                 requires => 'full',
1863                 type => 'string',
1864                 optional => 1,
1865                 enum => [ 'raw', 'qcow2', 'vmdk'],
1866             },
1867             full => {
1868                 optional => 1,
1869                 type => 'boolean',
1870                 description => "Create a full copy of all disk. This is always done when " .
1871                     "you clone a normal VM. For VM templates, we try to create a linked clone by default.",
1872                 default => 0,
1873             },
1874             target => get_standard_option('pve-node', {
1875                 description => "Target node. Only allowed if the original VM is on shared storage.",
1876                 optional => 1,
1877             }),
1878         },
1879     },
1880     returns => {
1881         type => 'string',
1882     },
1883     code => sub {
1884         my ($param) = @_;
1885
1886         my $rpcenv = PVE::RPCEnvironment::get();
1887
1888         my $authuser = $rpcenv->get_user();
1889
1890         my $node = extract_param($param, 'node');
1891
1892         my $vmid = extract_param($param, 'vmid');
1893
1894         my $newid = extract_param($param, 'newid');
1895
1896         my $pool = extract_param($param, 'pool');
1897
1898         if (defined($pool)) {
1899             $rpcenv->check_pool_exist($pool);
1900         }
1901
1902         my $snapname = extract_param($param, 'snapname');
1903
1904         my $storage = extract_param($param, 'storage');
1905
1906         my $format = extract_param($param, 'format');
1907
1908         my $target = extract_param($param, 'target');
1909
1910         my $localnode = PVE::INotify::nodename();
1911
1912         undef $target if $target && ($target eq $localnode || $target eq 'localhost');
1913
1914         PVE::Cluster::check_node_exists($target) if $target;
1915
1916         my $storecfg = PVE::Storage::config();
1917
1918         if ($storage) {
1919             # check if storage is enabled on local node
1920             PVE::Storage::storage_check_enabled($storecfg, $storage);
1921             if ($target) {
1922                 # check if storage is available on target node
1923                 PVE::Storage::storage_check_node($storecfg, $storage, $target);
1924                 # clone only works if target storage is shared
1925                 my $scfg = PVE::Storage::storage_config($storecfg, $storage);
1926                 die "can't clone to non-shared storage '$storage'\n" if !$scfg->{shared};
1927             }
1928         }
1929
1930         PVE::Cluster::check_cfs_quorum();
1931
1932         my $running = PVE::QemuServer::check_running($vmid) || 0;
1933
1934         # exclusive lock if VM is running - else shared lock is enough;
1935         my $shared_lock = $running ? 0 : 1;
1936
1937         my $clonefn = sub {
1938
1939             # do all tests after lock
1940             # we also try to do all tests before we fork the worker
1941
1942             my $conf = PVE::QemuServer::load_config($vmid);
1943
1944             PVE::QemuServer::check_lock($conf);
1945
1946             my $verify_running = PVE::QemuServer::check_running($vmid) || 0;
1947
1948             die "unexpected state change\n" if $verify_running != $running;
1949
1950             die "snapshot '$snapname' does not exist\n"
1951                 if $snapname && !defined( $conf->{snapshots}->{$snapname});
1952
1953             my $oldconf = $snapname ? $conf->{snapshots}->{$snapname} : $conf;
1954
1955             my $sharedvm = &$check_storage_access_clone($rpcenv, $authuser, $storecfg, $oldconf, $storage);
1956
1957             die "can't clone VM to node '$target' (VM uses local storage)\n" if $target && !$sharedvm;
1958
1959             my $conffile = PVE::QemuServer::config_file($newid);
1960
1961             die "unable to create VM $newid: config file already exists\n"
1962                 if -f $conffile;
1963
1964             my $newconf = { lock => 'clone' };
1965             my $drives = {};
1966             my $vollist = [];
1967
1968             foreach my $opt (keys %$oldconf) {
1969                 my $value = $oldconf->{$opt};
1970
1971                 # do not copy snapshot related info
1972                 next if $opt eq 'snapshots' ||  $opt eq 'parent' || $opt eq 'snaptime' ||
1973                     $opt eq 'vmstate' || $opt eq 'snapstate';
1974
1975                 # always change MAC! address
1976                 if ($opt =~ m/^net(\d+)$/) {
1977                     my $net = PVE::QemuServer::parse_net($value);
1978                     $net->{macaddr} =  PVE::Tools::random_ether_addr();
1979                     $newconf->{$opt} = PVE::QemuServer::print_net($net);
1980                 } elsif (my $drive = PVE::QemuServer::parse_drive($opt, $value)) {
1981                     if (PVE::QemuServer::drive_is_cdrom($drive)) {
1982                         $newconf->{$opt} = $value; # simply copy configuration
1983                     } else {
1984                         if ($param->{full} || !PVE::Storage::volume_is_base($storecfg,  $drive->{file})) {
1985                             die "Full clone feature is not available"
1986                                 if !PVE::Storage::volume_has_feature($storecfg, 'copy', $drive->{file}, $snapname, $running);
1987                             $drive->{full} = 1;
1988                         }
1989                         $drives->{$opt} = $drive;
1990                         push @$vollist, $drive->{file};
1991                     }
1992                 } else {
1993                     # copy everything else
1994                     $newconf->{$opt} = $value;
1995                 }
1996             }
1997
1998             delete $newconf->{template};
1999
2000             if ($param->{name}) {
2001                 $newconf->{name} = $param->{name};
2002             } else {
2003                 if ($oldconf->{name}) {
2004                     $newconf->{name} = "Copy-of-$oldconf->{name}";
2005                 } else {
2006                     $newconf->{name} = "Copy-of-VM-$vmid";
2007                 }
2008             }
2009
2010             if ($param->{description}) {
2011                 $newconf->{description} = $param->{description};
2012             }
2013
2014             # create empty/temp config - this fails if VM already exists on other node
2015             PVE::Tools::file_set_contents($conffile, "# qmclone temporary file\nlock: clone\n");
2016
2017             my $realcmd = sub {
2018                 my $upid = shift;
2019
2020                 my $newvollist = [];
2021
2022                 eval {
2023                     local $SIG{INT} = $SIG{TERM} = $SIG{QUIT} = $SIG{HUP} = sub { die "interrupted by signal\n"; };
2024
2025                     PVE::Storage::activate_volumes($storecfg, $vollist);
2026
2027                     foreach my $opt (keys %$drives) {
2028                         my $drive = $drives->{$opt};
2029
2030                         my $newdrive = PVE::QemuServer::clone_disk($storecfg, $vmid, $running, $opt, $drive, $snapname,
2031                                                                    $newid, $storage, $format, $drive->{full}, $newvollist);
2032
2033                         $newconf->{$opt} = PVE::QemuServer::print_drive($vmid, $newdrive);
2034
2035                         PVE::QemuServer::update_config_nolock($newid, $newconf, 1);
2036                     }
2037
2038                     delete $newconf->{lock};
2039                     PVE::QemuServer::update_config_nolock($newid, $newconf, 1);
2040
2041                     if ($target) {
2042                         my $newconffile = PVE::QemuServer::config_file($newid, $target);
2043                         die "Failed to move config to node '$target' - rename failed: $!\n"
2044                             if !rename($conffile, $newconffile);
2045                     }
2046
2047                     PVE::AccessControl::add_vm_to_pool($newid, $pool) if $pool;
2048                 };
2049                 if (my $err = $@) {
2050                     unlink $conffile;
2051
2052                     sleep 1; # some storage like rbd need to wait before release volume - really?
2053
2054                     foreach my $volid (@$newvollist) {
2055                         eval { PVE::Storage::vdisk_free($storecfg, $volid); };
2056                         warn $@ if $@;
2057                     }
2058                     die "clone failed: $err";
2059                 }
2060
2061                 return;
2062             };
2063
2064             return $rpcenv->fork_worker('qmclone', $vmid, $authuser, $realcmd);
2065         };
2066
2067         return PVE::QemuServer::lock_config_mode($vmid, 1, $shared_lock, sub {
2068             # Aquire exclusive lock lock for $newid
2069             return PVE::QemuServer::lock_config_full($newid, 1, $clonefn);
2070         });
2071
2072     }});
2073
2074 __PACKAGE__->register_method({
2075     name => 'migrate_vm',
2076     path => '{vmid}/migrate',
2077     method => 'POST',
2078     protected => 1,
2079     proxyto => 'node',
2080     description => "Migrate virtual machine. Creates a new migration task.",
2081     permissions => {
2082         check => ['perm', '/vms/{vmid}', [ 'VM.Migrate' ]],
2083     },
2084     parameters => {
2085         additionalProperties => 0,
2086         properties => {
2087             node => get_standard_option('pve-node'),
2088             vmid => get_standard_option('pve-vmid'),
2089             target => get_standard_option('pve-node', { description => "Target node." }),
2090             online => {
2091                 type => 'boolean',
2092                 description => "Use online/live migration.",
2093                 optional => 1,
2094             },
2095             force => {
2096                 type => 'boolean',
2097                 description => "Allow to migrate VMs which use local devices. Only root may use this option.",
2098                 optional => 1,
2099             },
2100         },
2101     },
2102     returns => {
2103         type => 'string',
2104         description => "the task ID.",
2105     },
2106     code => sub {
2107         my ($param) = @_;
2108
2109         my $rpcenv = PVE::RPCEnvironment::get();
2110
2111         my $authuser = $rpcenv->get_user();
2112
2113         my $target = extract_param($param, 'target');
2114
2115         my $localnode = PVE::INotify::nodename();
2116         raise_param_exc({ target => "target is local node."}) if $target eq $localnode;
2117
2118         PVE::Cluster::check_cfs_quorum();
2119
2120         PVE::Cluster::check_node_exists($target);
2121
2122         my $targetip = PVE::Cluster::remote_node_ip($target);
2123
2124         my $vmid = extract_param($param, 'vmid');
2125
2126         raise_param_exc({ force => "Only root may use this option." })
2127             if $param->{force} && $authuser ne 'root@pam';
2128
2129         # test if VM exists
2130         my $conf = PVE::QemuServer::load_config($vmid);
2131
2132         # try to detect errors early
2133
2134         PVE::QemuServer::check_lock($conf);
2135
2136         if (PVE::QemuServer::check_running($vmid)) {
2137             die "cant migrate running VM without --online\n"
2138                 if !$param->{online};
2139         }
2140
2141         my $storecfg = PVE::Storage::config();
2142         PVE::QemuServer::check_storage_availability($storecfg, $conf, $target);
2143
2144         if (&$vm_is_ha_managed($vmid) && $rpcenv->{type} ne 'ha') {
2145
2146             my $hacmd = sub {
2147                 my $upid = shift;
2148
2149                 my $service = "pvevm:$vmid";
2150
2151                 my $cmd = ['clusvcadm', '-M', $service, '-m', $target];
2152
2153                 print "Executing HA migrate for VM $vmid to node $target\n";
2154
2155                 PVE::Tools::run_command($cmd);
2156
2157                 return;
2158             };
2159
2160             return $rpcenv->fork_worker('hamigrate', $vmid, $authuser, $hacmd);
2161
2162         } else {
2163
2164             my $realcmd = sub {
2165                 my $upid = shift;
2166
2167                 PVE::QemuMigrate->migrate($target, $targetip, $vmid, $param);
2168             };
2169
2170             return $rpcenv->fork_worker('qmigrate', $vmid, $authuser, $realcmd);
2171         }
2172
2173     }});
2174
2175 __PACKAGE__->register_method({
2176     name => 'monitor',
2177     path => '{vmid}/monitor',
2178     method => 'POST',
2179     protected => 1,
2180     proxyto => 'node',
2181     description => "Execute Qemu monitor commands.",
2182     permissions => {
2183         check => ['perm', '/vms/{vmid}', [ 'VM.Monitor' ]],
2184     },
2185     parameters => {
2186         additionalProperties => 0,
2187         properties => {
2188             node => get_standard_option('pve-node'),
2189             vmid => get_standard_option('pve-vmid'),
2190             command => {
2191                 type => 'string',
2192                 description => "The monitor command.",
2193             }
2194         },
2195     },
2196     returns => { type => 'string'},
2197     code => sub {
2198         my ($param) = @_;
2199
2200         my $vmid = $param->{vmid};
2201
2202         my $conf = PVE::QemuServer::load_config ($vmid); # check if VM exists
2203
2204         my $res = '';
2205         eval {
2206             $res = PVE::QemuServer::vm_human_monitor_command($vmid, $param->{command});
2207         };
2208         $res = "ERROR: $@" if $@;
2209
2210         return $res;
2211     }});
2212
2213 __PACKAGE__->register_method({
2214     name => 'resize_vm',
2215     path => '{vmid}/resize',
2216     method => 'PUT',
2217     protected => 1,
2218     proxyto => 'node',
2219     description => "Extend volume size.",
2220     permissions => {
2221         check => ['perm', '/vms/{vmid}', [ 'VM.Config.Disk' ]],
2222     },
2223     parameters => {
2224         additionalProperties => 0,
2225         properties => {
2226             node => get_standard_option('pve-node'),
2227             vmid => get_standard_option('pve-vmid'),
2228             skiplock => get_standard_option('skiplock'),
2229             disk => {
2230                 type => 'string',
2231                 description => "The disk you want to resize.",
2232                 enum => [PVE::QemuServer::disknames()],
2233             },
2234             size => {
2235                 type => 'string',
2236                 pattern => '\+?\d+(\.\d+)?[KMGT]?',
2237                 description => "The new size. With the '+' sign the value is added to the actual size of the volume and without it, the value is taken as an absolute one. Shrinking disk size is not supported.",
2238             },
2239             digest => {
2240                 type => 'string',
2241                 description => 'Prevent changes if current configuration file has different SHA1 digest. This can be used to prevent concurrent modifications.',
2242                 maxLength => 40,
2243                 optional => 1,
2244             },
2245         },
2246     },
2247     returns => { type => 'null'},
2248     code => sub {
2249         my ($param) = @_;
2250
2251         my $rpcenv = PVE::RPCEnvironment::get();
2252
2253         my $authuser = $rpcenv->get_user();
2254
2255         my $node = extract_param($param, 'node');
2256
2257         my $vmid = extract_param($param, 'vmid');
2258
2259         my $digest = extract_param($param, 'digest');
2260
2261         my $disk = extract_param($param, 'disk');
2262
2263         my $sizestr = extract_param($param, 'size');
2264
2265         my $skiplock = extract_param($param, 'skiplock');
2266         raise_param_exc({ skiplock => "Only root may use this option." })
2267             if $skiplock && $authuser ne 'root@pam';
2268
2269         my $storecfg = PVE::Storage::config();
2270
2271         my $updatefn =  sub {
2272
2273             my $conf = PVE::QemuServer::load_config($vmid);
2274
2275             die "checksum missmatch (file change by other user?)\n"
2276                 if $digest && $digest ne $conf->{digest};
2277             PVE::QemuServer::check_lock($conf) if !$skiplock;
2278
2279             die "disk '$disk' does not exist\n" if !$conf->{$disk};
2280
2281             my $drive = PVE::QemuServer::parse_drive($disk, $conf->{$disk});
2282
2283             my $volid = $drive->{file};
2284
2285             die "disk '$disk' has no associated volume\n" if !$volid;
2286
2287             die "you can't resize a cdrom\n" if PVE::QemuServer::drive_is_cdrom($drive);
2288
2289             die "you can't online resize a virtio windows bootdisk\n"
2290                 if PVE::QemuServer::check_running($vmid) && $conf->{bootdisk} eq $disk && $conf->{ostype} =~ m/^w/ && $disk =~ m/^virtio/;
2291
2292             my ($storeid, $volname) = PVE::Storage::parse_volume_id($volid);
2293
2294             $rpcenv->check($authuser, "/storage/$storeid", ['Datastore.AllocateSpace']);
2295
2296             my $size = PVE::Storage::volume_size_info($storecfg, $volid, 5);
2297
2298             die "internal error" if $sizestr !~ m/^(\+)?(\d+(\.\d+)?)([KMGT])?$/;
2299             my ($ext, $newsize, $unit) = ($1, $2, $4);
2300             if ($unit) {
2301                 if ($unit eq 'K') {
2302                     $newsize = $newsize * 1024;
2303                 } elsif ($unit eq 'M') {
2304                     $newsize = $newsize * 1024 * 1024;
2305                 } elsif ($unit eq 'G') {
2306                     $newsize = $newsize * 1024 * 1024 * 1024;
2307                 } elsif ($unit eq 'T') {
2308                     $newsize = $newsize * 1024 * 1024 * 1024 * 1024;
2309                 }
2310             }
2311             $newsize += $size if $ext;
2312             $newsize = int($newsize);
2313
2314             die "unable to skrink disk size\n" if $newsize < $size;
2315
2316             return if $size == $newsize;
2317
2318             PVE::Cluster::log_msg('info', $authuser, "update VM $vmid: resize --disk $disk --size $sizestr");
2319
2320             PVE::QemuServer::qemu_block_resize($vmid, "drive-$disk", $storecfg, $volid, $newsize);
2321
2322             $drive->{size} = $newsize;
2323             $conf->{$disk} = PVE::QemuServer::print_drive($vmid, $drive);
2324
2325             PVE::QemuServer::update_config_nolock($vmid, $conf, 1);
2326         };
2327
2328         PVE::QemuServer::lock_config($vmid, $updatefn);
2329         return undef;
2330     }});
2331
2332 __PACKAGE__->register_method({
2333     name => 'snapshot_list',
2334     path => '{vmid}/snapshot',
2335     method => 'GET',
2336     description => "List all snapshots.",
2337     permissions => {
2338         check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
2339     },
2340     proxyto => 'node',
2341     protected => 1, # qemu pid files are only readable by root
2342     parameters => {
2343         additionalProperties => 0,
2344         properties => {
2345             vmid => get_standard_option('pve-vmid'),
2346             node => get_standard_option('pve-node'),
2347         },
2348     },
2349     returns => {
2350         type => 'array',
2351         items => {
2352             type => "object",
2353             properties => {},
2354         },
2355         links => [ { rel => 'child', href => "{name}" } ],
2356     },
2357     code => sub {
2358         my ($param) = @_;
2359
2360         my $vmid = $param->{vmid};
2361
2362         my $conf = PVE::QemuServer::load_config($vmid);
2363         my $snaphash = $conf->{snapshots} || {};
2364
2365         my $res = [];
2366
2367         foreach my $name (keys %$snaphash) {
2368             my $d = $snaphash->{$name};
2369             my $item = {
2370                 name => $name,
2371                 snaptime => $d->{snaptime} || 0,
2372                 vmstate => $d->{vmstate} ? 1 : 0,
2373                 description => $d->{description} || '',
2374             };
2375             $item->{parent} = $d->{parent} if $d->{parent};
2376             $item->{snapstate} = $d->{snapstate} if $d->{snapstate};
2377             push @$res, $item;
2378         }
2379
2380         my $running = PVE::QemuServer::check_running($vmid, 1) ? 1 : 0;
2381         my $current = { name => 'current', digest => $conf->{digest}, running => $running };
2382         $current->{parent} = $conf->{parent} if $conf->{parent};
2383
2384         push @$res, $current;
2385
2386         return $res;
2387     }});
2388
2389 __PACKAGE__->register_method({
2390     name => 'snapshot',
2391     path => '{vmid}/snapshot',
2392     method => 'POST',
2393     protected => 1,
2394     proxyto => 'node',
2395     description => "Snapshot a VM.",
2396     permissions => {
2397         check => ['perm', '/vms/{vmid}', [ 'VM.Snapshot' ]],
2398     },
2399     parameters => {
2400         additionalProperties => 0,
2401         properties => {
2402             node => get_standard_option('pve-node'),
2403             vmid => get_standard_option('pve-vmid'),
2404             snapname => get_standard_option('pve-snapshot-name'),
2405             vmstate => {
2406                 optional => 1,
2407                 type => 'boolean',
2408                 description => "Save the vmstate",
2409             },
2410             freezefs => {
2411                 optional => 1,
2412                 type => 'boolean',
2413                 description => "Freeze the filesystem",
2414             },
2415             description => {
2416                 optional => 1,
2417                 type => 'string',
2418                 description => "A textual description or comment.",
2419             },
2420         },
2421     },
2422     returns => {
2423         type => 'string',
2424         description => "the task ID.",
2425     },
2426     code => sub {
2427         my ($param) = @_;
2428
2429         my $rpcenv = PVE::RPCEnvironment::get();
2430
2431         my $authuser = $rpcenv->get_user();
2432
2433         my $node = extract_param($param, 'node');
2434
2435         my $vmid = extract_param($param, 'vmid');
2436
2437         my $snapname = extract_param($param, 'snapname');
2438
2439         die "unable to use snapshot name 'current' (reserved name)\n"
2440             if $snapname eq 'current';
2441
2442         my $realcmd = sub {
2443             PVE::Cluster::log_msg('info', $authuser, "snapshot VM $vmid: $snapname");
2444             PVE::QemuServer::snapshot_create($vmid, $snapname, $param->{vmstate},
2445                                              $param->{freezefs}, $param->{description});
2446         };
2447
2448         return $rpcenv->fork_worker('qmsnapshot', $vmid, $authuser, $realcmd);
2449     }});
2450
2451 __PACKAGE__->register_method({
2452     name => 'snapshot_cmd_idx',
2453     path => '{vmid}/snapshot/{snapname}',
2454     description => '',
2455     method => 'GET',
2456     permissions => {
2457         user => 'all',
2458     },
2459     parameters => {
2460         additionalProperties => 0,
2461         properties => {
2462             vmid => get_standard_option('pve-vmid'),
2463             node => get_standard_option('pve-node'),
2464             snapname => get_standard_option('pve-snapshot-name'),
2465         },
2466     },
2467     returns => {
2468         type => 'array',
2469         items => {
2470             type => "object",
2471             properties => {},
2472         },
2473         links => [ { rel => 'child', href => "{cmd}" } ],
2474     },
2475     code => sub {
2476         my ($param) = @_;
2477
2478         my $res = [];
2479
2480         push @$res, { cmd => 'rollback' };
2481         push @$res, { cmd => 'config' };
2482
2483         return $res;
2484     }});
2485
2486 __PACKAGE__->register_method({
2487     name => 'update_snapshot_config',
2488     path => '{vmid}/snapshot/{snapname}/config',
2489     method => 'PUT',
2490     protected => 1,
2491     proxyto => 'node',
2492     description => "Update snapshot metadata.",
2493     permissions => {
2494         check => ['perm', '/vms/{vmid}', [ 'VM.Snapshot' ]],
2495     },
2496     parameters => {
2497         additionalProperties => 0,
2498         properties => {
2499             node => get_standard_option('pve-node'),
2500             vmid => get_standard_option('pve-vmid'),
2501             snapname => get_standard_option('pve-snapshot-name'),
2502             description => {
2503                 optional => 1,
2504                 type => 'string',
2505                 description => "A textual description or comment.",
2506             },
2507         },
2508     },
2509     returns => { type => 'null' },
2510     code => sub {
2511         my ($param) = @_;
2512
2513         my $rpcenv = PVE::RPCEnvironment::get();
2514
2515         my $authuser = $rpcenv->get_user();
2516
2517         my $vmid = extract_param($param, 'vmid');
2518
2519         my $snapname = extract_param($param, 'snapname');
2520
2521         return undef if !defined($param->{description});
2522
2523         my $updatefn =  sub {
2524
2525             my $conf = PVE::QemuServer::load_config($vmid);
2526
2527             PVE::QemuServer::check_lock($conf);
2528
2529             my $snap = $conf->{snapshots}->{$snapname};
2530
2531             die "snapshot '$snapname' does not exist\n" if !defined($snap);
2532
2533             $snap->{description} = $param->{description} if defined($param->{description});
2534
2535              PVE::QemuServer::update_config_nolock($vmid, $conf, 1);
2536         };
2537
2538         PVE::QemuServer::lock_config($vmid, $updatefn);
2539
2540         return undef;
2541     }});
2542
2543 __PACKAGE__->register_method({
2544     name => 'get_snapshot_config',
2545     path => '{vmid}/snapshot/{snapname}/config',
2546     method => 'GET',
2547     proxyto => 'node',
2548     description => "Get snapshot configuration",
2549     permissions => {
2550         check => ['perm', '/vms/{vmid}', [ 'VM.Snapshot' ]],
2551     },
2552     parameters => {
2553         additionalProperties => 0,
2554         properties => {
2555             node => get_standard_option('pve-node'),
2556             vmid => get_standard_option('pve-vmid'),
2557             snapname => get_standard_option('pve-snapshot-name'),
2558         },
2559     },
2560     returns => { type => "object" },
2561     code => sub {
2562         my ($param) = @_;
2563
2564         my $rpcenv = PVE::RPCEnvironment::get();
2565
2566         my $authuser = $rpcenv->get_user();
2567
2568         my $vmid = extract_param($param, 'vmid');
2569
2570         my $snapname = extract_param($param, 'snapname');
2571
2572         my $conf = PVE::QemuServer::load_config($vmid);
2573
2574         my $snap = $conf->{snapshots}->{$snapname};
2575
2576         die "snapshot '$snapname' does not exist\n" if !defined($snap);
2577
2578         return $snap;
2579     }});
2580
2581 __PACKAGE__->register_method({
2582     name => 'rollback',
2583     path => '{vmid}/snapshot/{snapname}/rollback',
2584     method => 'POST',
2585     protected => 1,
2586     proxyto => 'node',
2587     description => "Rollback VM state to specified snapshot.",
2588     permissions => {
2589         check => ['perm', '/vms/{vmid}', [ 'VM.Snapshot' ]],
2590     },
2591     parameters => {
2592         additionalProperties => 0,
2593         properties => {
2594             node => get_standard_option('pve-node'),
2595             vmid => get_standard_option('pve-vmid'),
2596             snapname => get_standard_option('pve-snapshot-name'),
2597         },
2598     },
2599     returns => {
2600         type => 'string',
2601         description => "the task ID.",
2602     },
2603     code => sub {
2604         my ($param) = @_;
2605
2606         my $rpcenv = PVE::RPCEnvironment::get();
2607
2608         my $authuser = $rpcenv->get_user();
2609
2610         my $node = extract_param($param, 'node');
2611
2612         my $vmid = extract_param($param, 'vmid');
2613
2614         my $snapname = extract_param($param, 'snapname');
2615
2616         my $realcmd = sub {
2617             PVE::Cluster::log_msg('info', $authuser, "rollback snapshot VM $vmid: $snapname");
2618             PVE::QemuServer::snapshot_rollback($vmid, $snapname);
2619         };
2620
2621         return $rpcenv->fork_worker('qmrollback', $vmid, $authuser, $realcmd);
2622     }});
2623
2624 __PACKAGE__->register_method({
2625     name => 'delsnapshot',
2626     path => '{vmid}/snapshot/{snapname}',
2627     method => 'DELETE',
2628     protected => 1,
2629     proxyto => 'node',
2630     description => "Delete a VM snapshot.",
2631     permissions => {
2632         check => ['perm', '/vms/{vmid}', [ 'VM.Snapshot' ]],
2633     },
2634     parameters => {
2635         additionalProperties => 0,
2636         properties => {
2637             node => get_standard_option('pve-node'),
2638             vmid => get_standard_option('pve-vmid'),
2639             snapname => get_standard_option('pve-snapshot-name'),
2640             force => {
2641                 optional => 1,
2642                 type => 'boolean',
2643                 description => "For removal from config file, even if removing disk snapshots fails.",
2644             },
2645         },
2646     },
2647     returns => {
2648         type => 'string',
2649         description => "the task ID.",
2650     },
2651     code => sub {
2652         my ($param) = @_;
2653
2654         my $rpcenv = PVE::RPCEnvironment::get();
2655
2656         my $authuser = $rpcenv->get_user();
2657
2658         my $node = extract_param($param, 'node');
2659
2660         my $vmid = extract_param($param, 'vmid');
2661
2662         my $snapname = extract_param($param, 'snapname');
2663
2664         my $realcmd = sub {
2665             PVE::Cluster::log_msg('info', $authuser, "delete snapshot VM $vmid: $snapname");
2666             PVE::QemuServer::snapshot_delete($vmid, $snapname, $param->{force});
2667         };
2668
2669         return $rpcenv->fork_worker('qmdelsnapshot', $vmid, $authuser, $realcmd);
2670     }});
2671
2672 __PACKAGE__->register_method({
2673     name => 'template',
2674     path => '{vmid}/template',
2675     method => 'POST',
2676     protected => 1,
2677     proxyto => 'node',
2678     description => "Create a Template.",
2679     permissions => {
2680         description => "You need 'VM.Allocate' permissions on /vms/{vmid}",
2681         check => [ 'perm', '/vms/{vmid}', ['VM.Allocate']],
2682     },
2683     parameters => {
2684         additionalProperties => 0,
2685         properties => {
2686             node => get_standard_option('pve-node'),
2687             vmid => get_standard_option('pve-vmid'),
2688             disk => {
2689                 optional => 1,
2690                 type => 'string',
2691                 description => "If you want to convert only 1 disk to base image.",
2692                 enum => [PVE::QemuServer::disknames()],
2693             },
2694
2695         },
2696     },
2697     returns => { type => 'null'},
2698     code => sub {
2699         my ($param) = @_;
2700
2701         my $rpcenv = PVE::RPCEnvironment::get();
2702
2703         my $authuser = $rpcenv->get_user();
2704
2705         my $node = extract_param($param, 'node');
2706
2707         my $vmid = extract_param($param, 'vmid');
2708
2709         my $disk = extract_param($param, 'disk');
2710
2711         my $updatefn =  sub {
2712
2713             my $conf = PVE::QemuServer::load_config($vmid);
2714
2715             PVE::QemuServer::check_lock($conf);
2716
2717             die "unable to create template, because VM contains snapshots\n"
2718                 if $conf->{snapshots} && scalar(keys %{$conf->{snapshots}});
2719
2720             die "you can't convert a template to a template\n"
2721                 if PVE::QemuServer::is_template($conf) && !$disk;
2722
2723             die "you can't convert a VM to template if VM is running\n"
2724                 if PVE::QemuServer::check_running($vmid);
2725
2726             my $realcmd = sub {
2727                 PVE::QemuServer::template_create($vmid, $conf, $disk);
2728             };
2729
2730             $conf->{template} = 1;
2731             PVE::QemuServer::update_config_nolock($vmid, $conf, 1);
2732
2733             return $rpcenv->fork_worker('qmtemplate', $vmid, $authuser, $realcmd);
2734         };
2735
2736         PVE::QemuServer::lock_config($vmid, $updatefn);
2737         return undef;
2738     }});
2739
2740 1;